5,060 reputation
1734
bio website
location Netherlands
age 40
visits member for 2 years, 11 months
seen 7 hours ago

Java and security expert with over 10 years of experience with the language and with the practical application of cryptographic protocols - including the design of protocols within international standardization bodies. Creator of a heavily used common criteria certified product. Over 30 years of experience with computers. Likes kids, cats, reading, movies and several sports.


Sep
20
revised Modes of operation for Public Key Encryption schemes
added 10 characters in body
Sep
20
answered Modes of operation for Public Key Encryption schemes
Sep
20
revised Understanding Pseudo Random Generators
added 7 characters in body
Sep
20
accepted GCM: Math behind update of AAD after ciphertext has been processed
Sep
18
comment How do institutions like banks do RSA with big primes?
But notice that OpenSSL is pretty fast with regards to these kind of calculations. You may have much worse results on interpreted code (e.g. on the JVM), let alone interpreted code.
Sep
18
comment GCM: Math behind update of AAD after ciphertext has been processed
Well, it does work for sure. It seems that it first calculates $\operatorname{GHASH}_H(A_{0..x}||C)$ (including the zero padding), removes the padded $\operatorname{GHASH}_H(A_{0..x})$ and substitutes the new $A_{0...z}$, which was continued from the unpadded $\operatorname{GHASH}_H(A_{0..x})$... at least if I interpret the code correctly.
Sep
17
comment GCM: Math behind update of AAD after ciphertext has been processed
So if there is already AAD data then we can just exponentiate the difference, where the difference is calculated with XOR, right? Bouncy also works for $A_{0..x} || C || A_{(x+1)..z}$...
Sep
17
comment What is the technical name for a public key container in DER format?
I do not agree with the close votes. This is not about decoding or decrypting a piece of ciphertext, it is about identifying a cryptography related data structure. That is both a concise question and of use to others.
Sep
16
revised GCM: Math behind update of AAD after ciphertext has been processed
added 57 characters in body; edited title
Sep
16
comment GCM: Math behind update of AAD after ciphertext has been processed
I'm improving the GCM code of Bouncy Castle, making the nice properties of CTR return. I've already got everything running, but I still need to integrate this feature. I can do this better if I understand the involved mathematics.
Sep
16
asked GCM: Math behind update of AAD after ciphertext has been processed
Sep
11
revised AES-GCM Disadvantage
deleted 3 characters in body
Sep
11
revised AES-GCM Disadvantage
added 85 characters in body
Sep
11
comment AES-GCM Disadvantage
Done, same to you, if you think it is unclear, edit or let me know. I thought disclosure of a key is too serious to ignore, I mean, an authentication function cannot get more broken than that.
Sep
11
comment AES-GCM Disadvantage
I've removed my answer as Dimitry's answer is much better (don't forget to accept). But I'll put it here as a comment: the goal of the competition is to find better schemes of authenticated encryption. Even though GCM has many disadvantages, it seems mainly used as a base line within the competition. That does not mean that the previous modes have been broken, or that there is one particular advantage that they focus on.
Sep
11
comment AES-GCM Disadvantage
In Authentication weaknesses in GCM Niels Fergusson states (about forgeries): "This quickly leads to a situation in which the attacker knows all of H, after which arbitrary forgeries can be created without any chance of detection by the receiver." where H is the data used as authentication key (!). So short tags leads to complete loss of authentication, even for ciphertext with a larger tag used later on. This is clearly a more potent statement than your second statement.
Sep
10
comment Advantages of using intermediate hash over full hash in digital signature application
Still no substantial reasons other than that apparently some cryptographers want to maintain them in the standard.
Sep
8
comment Why does FIPS 186-4 require specific sizes for keys?
I wish NIST would do the same for KDF's. It's a mess with multiple MB of test vectors, that still don't cover all the options, and all the verified implementations (CAVP) implement a different KDF's.
Sep
8
comment How can SSL secure a two-way communication with only one key-pair?
Are there ciphersuites that only perform client authentication? Which ones?
Sep
8
comment Bit padding instead of PKCS#5 padding
@PaŭloEbermann I guess in principle you could extract timing information, but finding timing information about unpadding a bit string may be tricky (as it will take almost no time at all). That said, it can be done, e.g. by carefully putting the plaintext + padding on a page boundary of a modern CPU. Paging can be used to extract timing information.